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February 27, 2015 


VIA U.S. MAIL 

Virginia Attorney General Mark R. Herring 
Office of the Attorney General 
900 East Main Street 
Richmond, VA 23219 

Re: Anthem, Inc. Data Breach 

Dear Attorney General Herring: 
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Pursuant to Va. Code Ann. §18.2-186.6, we write to inform you that a downstream 
subcontractor, Anthem, Inc. (“Anthem”), to McDermott Will & Emery LLP (“McDermott”)’s 
employer-sponsored group health plan was the victim of a cyber-attack, commencing on or about 
December 10, 2014, and initially discovered by Anthem on or about January 29, 2015. 


We understand that Anthem may have previously notified you of this incident. Because 
McDermott is the owner of information about our employees that may have been compromised 
by this cyber-attack, we are writing separately to notify you of the incident and meet any 
obligations we may have under state law. 


To clarify the relationships involved, the health insurance plan that McDermott provides to its 
employees is the McDermott BlueCross BlueShield medical plan (“the Plan”). The Plan is 
administered by BlueCross BlueShield of Illinois (“BCBSIL”), and not by Anthem. However, 
we understand from BCBSIL that Anthem plays a role in processing claims for the McDermott 
Plan participants who have received medical care and services in states where Anthem 
operates. Anthem is a sendee provider to BCBSIL. 


We have been in direct communication with BCBSIL. Through BCBSIL, we learned that, on 
January 29, 2015, Anthem discovered that cyber attackers executed a sophisticated attack to gain 
unauthorized access to Anthem’s databases that store employee and customer data. In its initial 
communication to us, BCBSIL stated that it was not clear how many records had been exposed, 
or if any data pertaining to McDermott Plan participants was part of the exposed data. It also 
reported that, while the forensics investigation is ongoing to determine whose information was 
accessed. Anthem reported that no medical records were accessed in the breach. 
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Recently, BCBSIL notified us that Anthem provided it with a data file containing further 
information about individuals potentially affected by the data breach. BCBSIL is presently 
examining this file to determine if any of the McDermott Plan participants may have been 
impacted. To date, BCBSIL has not yet been able to identify for McDermott any affected Plan 
participants, nor the states where any affected individuals reside. 

However, BCBSIL recently notified us that its “preliminary analysis suggests that protected 
health information and/or personal information about your members, including addresses, dates 
of birth, and telephone numbers may have been impacted. ” (emphasis supplied). The BCBSIL 
notice indicated that “[a] small percentage of member Social Security numbers were 
exposed.” The BCBSIL notice also indicated, “If your members have not received health care in 
the following Anthem locations, they are not likely to have been impacted by Anthem’s data 
breach: California, Colorado, Connecticut, Georgia, Indiana, Kentucky, Maine, Missouri, 
Nevada, New Hampshire, New York, Ohio, Virginia or Wisconsin.” Further, it states that not all 
members who did receive care in those listed states have had their information impacted. 

McDermott has Plan participants in your state. Though we do not yet know definitively if they 
have been affected, we write to inform you of the data breach at this time, as BCBSIL identified 
your state as one of the states in which our Plan participants’ data may have been 
impacted. BCBSIL has informed us that it will provide us the specific numbers of impacted 
residents of your state and the identity of those residents when it has completed its 
analysis. Once we have received that information, we will ensure that any consumer notification 
obligations are met promptly, and will notify you accordingly. 

In the meantime, if you have any questions please do not hesitate to contact me. 


Sincerely, 



Ann I. Killilea 
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